Behavioral task
behavioral1
Sample
f8ede3122dd9aa36a147b9a41d3a546d0609bb88da55f7496126532836675504.exe
Resource
win7-20241010-en
General
-
Target
f8ede3122dd9aa36a147b9a41d3a546d0609bb88da55f7496126532836675504
-
Size
2.6MB
-
MD5
be4f3a0f5e489d376b19ec49691804fc
-
SHA1
8d715acf8a2c7b6e5778a97189f92463d5e0c0bd
-
SHA256
f8ede3122dd9aa36a147b9a41d3a546d0609bb88da55f7496126532836675504
-
SHA512
b15f1ed89443b0f2c8b67f2281fb62f68c8f786b6ba8268ac6cf13e1c3bbf5d172ade703ffa6aa4c0f3863ae34c3ca76c5c1119a019959907aa9aac04fcb92ff
-
SSDEEP
49152:auTwfYOLsbiLHkaipF71/46lhRD5EoG4tF773eEyZUjM:VwQOLgiQac9zhh5ztFQUjM
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f8ede3122dd9aa36a147b9a41d3a546d0609bb88da55f7496126532836675504
Files
-
f8ede3122dd9aa36a147b9a41d3a546d0609bb88da55f7496126532836675504.exe windows:4 windows x86 arch:x86
4b62211a11c6936b1890a59ecbd8a708
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvfw32
DrawDibDraw
avifil32
AVIStreamGetFrame
winmm
midiStreamOut
ws2_32
getsockname
kernel32
FlushFileBuffers
user32
LoadStringA
gdi32
CombineRgn
winspool.drv
OpenPrinterA
comdlg32
GetFileTitleA
advapi32
RegCreateKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CLSIDFromProgID
oleaut32
SafeArrayAccessData
comctl32
ImageList_DragMove
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 1.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ